Service Interaction Protocol
Write Memory By Address
Low-level write. 0x3D writes raw bytes to an absolute address in a single request — powerful and dangerous. The simulator gates it behind session, region, and (per-region) security checks. For firmware-sized payloads use the transfer chain (0x34 → 0x36 → 0x37) instead.
Overview
“The client uses WriteMemoryByAddress to write information into the server at one or more contiguous memory addresses.”
✅ Good fit
- Calibration values in RAM
- Configuration parameters (small)
- Temporary patches
❌ Use something else
- Firmware images → 0x34/0x36/0x37
- Named/structured data → 0x2E (DID)
- Protected / read-only regions
Write in Context
Step through a clean RAM write (with a 0x23 read-back), and the four ways the ECU refuses: security (0x33), protected (0x22), read-only (0x31), and wrong session (0x7F).
Write Runner
See 0x3D in context — a clean write, plus the four ways it gets refused.
Write 4 bytes to a RAM scratch region and verify with 0x23.
Press Play or Step to begin the sequence.
Build a Write
Set the ALFID, address, size, and ECU state. The builder assembles the request and shows the simulator’s exact response — a 0x7D acknowledgement or the precise NRC.
Request Builder
Set the ALFID, address, size, and ECU state — see the assembled write request and the simulator’s exact response.
ECU state
addressAndLengthFormatId = 0x44
Data is auto-filled to 4 byte(s) so the frame length is always valid.
Assembled request (14 bytes)
Write applied to RAM (scratch). The response echoes ALFID + the address bytes (not the size or data).
ECU response
Memory Map
Memory Map
Each region resolves to a different result: writable → 0x7D, protected → 0x22, secured-and-locked → 0x33, not-writable → 0x31. (Regions are ECU-configured; these are illustrative.)
* secured region → 0x33 only while locked; after a 0x27 unlock it writes (0x7D). Gaps between regions return 0x31.
- Range
- 0x20000000 – 0x20008000
- Size · Type
- 32 KB · RAM
- Writable
- yes
- Protected
- no
- Security level
- —
- 0x3D here
- 7D …
Message Structure
Inspect each byte of the request, the 0x7D response, and a negative response.
◆ PROTOCOL ANATOMY
0x3D WRITE MEMORY BY ADDRESS
0x3D RESPONSE
ALFID: high nibble = memorySize length, low nibble = memoryAddress length (e.g. 0x44 = 4-byte size + 4-byte address). The positive response echoes ALFID + address only — not the size or the data.
Session & Security
SID 0x3D WriteMemoryByAddress Matrix
Permissions by physical write target across diagnostic sessions. Select a row for details.
| Memory Target & Address Space | DEFAULT 0x01 | EXTENDED 0x03 | PROGRAMMING 0x02 | Security |
|---|---|---|---|---|
| ✗ | ✓ | ✓ | Level 1 | |
| ✗ | ✓ | ✓ | Level 1 | |
| ✗ | ✗ | ✓ | Level 3 Flash | |
| ✗ | ✗ | ~ | Level 5 Master |
Per-region security: unlike the transfer services, 0x3D only demands a 0x27 unlock when the target region defines a security level. A plain writable RAM region accepts the write with no unlock at all.
Writes targeting protected memory spaces without prior 0x27 authentication fail with NRC 0x33 (SecurityAccessDenied) or NRC 0x22 (ConditionsNotCorrect).
Server authorizes direct memory modification within bounds, executes memory write routines, and returns positive 0x7D echo.
| From Session | To Session | Transition Command | Security State Effect |
|---|---|---|---|
| 0x01 Default | 0x03 Extended | Enables extended diagnostics; memory security keys can now be submitted. | |
| 0x03 Extended | 0x01 Default | Security state immediately resets to LOCKED. Direct memory write privileges revoked. | |
| Any Session | ECU Reset | ECU resets to Default session; volatile RAM modifications may be cleared. |
Triggered when this service or requested resource requires an active security unlock that has not been granted.
Triggered during unlock attempts if the calculated key fails ECU cryptographic verification.
Enforced delay lockout if the maximum number of failed key submissions (typically 3) has been exceeded.
Service Dependencies
0x3D writes raw binary byte streams directly into specified physical microcontroller RAM or EEPROM memory addresses. Select a node to inspect interactions.
Write Memory Sequence
Secure Memory Write Execution Flow
8 stepsNegative Response Codes
EXCEPTION_MATRIX_V3
The byte count does not match 1 (SID) + 1 (ALFID) + addrLen + sizeLen + data bytes.
This negative response indicates a rejection while processing the Write Memory By Address (SID 0x3D) request. Verify preconditions, session levels, and message formatting per ISO 14229.
Troubleshooting Guide
Troubleshooting Guide
Click any issue to expand diagnosis and resolution.
ISO 14229-1 References
Standard: ISO 14229-1:2020 — WriteMemoryByAddress sits in the Data-transmission functional unit (§10), alongside its read counterpart ReadMemoryByAddress (0x23). Related: §0x27 SecurityAccess, §0x10 DiagnosticSessionControl.
Key points
- Request: 3D + ALFID + memoryAddress + memorySize + data
- addressAndLengthFormatIdentifier: high nibble = memorySize length, low nibble = memoryAddress length
- Positive response 7D echoes ALFID + address (this simulator does not echo size or data)
- Allowed in EXTENDED or PROGRAMMING; emits NRC 0x7F, 0x13, 0x31, 0x22, 0x33 (and 0x72 on an internal failure)
- A protected region returns 0x22; a non-writable / out-of-range one returns 0x31
Quick Reference & Best Practices
WriteMemoryByAddress
low-level writeRequest
Positive Response
- Service ID
- 0x3D
- Positive Response
- 0x7D
- Role
- Direct write to a memory address
- Required session
- EXTENDED or PROGRAMMING
- Security
- Per-region — only if the region needs it
- Response echoes
- ALFID + address (not the data, not the size)
- No transfer sequence
- One request writes the bytes (cf. 0x34/0x36)
- ISO ref
- ISO 14229-1:2020 §10 (Data transmission)